The KVKK document set for guest Wi-Fi: five documents and what the box supplies

The role first: you are the data controller

If you offer Wi-Fi to guests and verify a phone number at login, you are processing personal data. Under KVKK, Türkiye's data protection law, your business is the data controller. Hotspot-Box processes that data on your behalf, on your box. Our platform (hotspot-box.com) never sees a guest number; the box sends the SMS straight to the provider, and the platform only hands out API credentials and counts credits.

Being a data controller means keeping a document set. Below are the five documents guest Wi-Fi requires, what goes into each, and which part the box gives you ready-made. Have the final versions reviewed by your KVKK adviser.

The set at a glance

Document	What it describes	What the box supplies
VERBIS registration	Public declaration of what data you process, why and for how long	Clear input for data categories and retention period
Inventory row	The guest Wi-Fi process in your data inventory	Field list, source, transfer details
Retention and destruction policy	How long you keep data and how you delete it	730-day automatic deletion with audit trail
Access matrix	Who can access the data and with what rights	Role-based access, masked numbers
Notice and consent text	What you tell the guest and their approval	Display on the portal, consent record

1. VERBIS registration

VERBIS is the public registry where data controllers declare their processing activities. Whether you must register depends on the size of your business and the types of data you process; confirm that with your adviser. If you must, guest Wi-Fi goes in as its own processing activity.

Input from the box: data categories (contact data: phone number or e-mail; transaction security: MAC, internal IP, session times), purpose (obligations under Law 5651 and providing the service), retention period (2 years), transfers (none abroad; only digests go to the timestamp service).

2. Inventory row

Your personal data processing inventory has one row per process. The guest Wi-Fi row should contain:

• Process name: Guest internet access
• Data categories: contact data (phone/e-mail), transaction security (MAC, internal IP, session start and end, NAT mapping where applicable), consent record
• Source: the guest (portal login), the box (automatic network records)
• Legal basis: legal obligation (access records), explicit consent or contract (service provision); decide with your adviser which applies to which data
• Retention: 730 days
• Recipient groups: authorised public bodies (on request); SMS provider (the number, only to deliver the code)
• Transfer abroad: none
• Technical measures: encrypted number, role-based access, integrity chain, audit trail

The box fixes the "which fields are kept" part of that row. Because no visited sites, location or content are kept, your inventory stays short.

3. Retention and destruction policy

This document states the period and the deletion method for each data category. For guest Wi-Fi the period is clear: access records for 2 years (730 days). Three sentences form a sufficient skeleton for your policy:

1. Access records are kept for 730 days from the day they are created.
2. Expired daily record files are deleted automatically on the box.
3. Every deletion is written to the audit trail with its date and scope.

The box does all three itself. In an audit you show the deletion entries in the audit trail, not the policy document. Remember to state in the policy that the second copy taken over SFTP/FTPS is subject to the same period; deleting the external copy is your responsibility.

4. Access matrix

The access matrix is a table showing which role can access which data with which operation. The box's panel is role-based; only an authorised role sees guest phone numbers, and sees them masked. Example rows for your matrix:

Role	Access records	Phone number	Integrity verification	Export
Owner / controller's representative	Reads	Sees masked	Yes	Yes
Technical staff	Reads	Does not see	Yes	No
Till / reception	No access	Does not see	No	No

What each role does in the panel is written to the audit trail, which is how you prove the matrix is enforced.

5. Notice and consent text

Before entering a number, the guest must know what they are giving and why. The portal shows the privacy notice before login and keeps the explicit consent record. The text should cover:

• The identity of the data controller (your business)
• Which data is processed (phone/e-mail, MAC, internal IP, session times)
• Purpose (legal obligation and providing internet access)
• Retention period (2 years)
• Who it may be shared with (authorised public bodies, SMS provider)
• The guest's rights and how to exercise them

You write the portal text yourself; we provide the field, not a template. Do not use wrong statements such as "your browsing is recorded"; the box does not do that. In addition, you can manage guest requests (access, deletion) from the panel and anonymise records, so you do not need to design a separate request-handling process.

The short version

For four of the five documents the box gives you concrete, unchanging inputs: the field list, 730 days, the role structure, the consent record. What you write is what is specific to your business: the controller's identity, the choice of legal basis, the contact address for requests. During the trial you can see these inputs in the panel and fill in your documents from them; contact us. Common KVKK questions are answered in the FAQ.

This article is for general information only and is not legal advice.